Slightly more than half of cybersecurity professionals think AI is helping attackers more than defenders, according to Bitdefender’s newly released 2026 Cybersecurity Assessment Report. But the report’s most striking finding concerns not technology at all, but organisational behaviour: 55.2 per cent of respondents who experienced a security incident or breach in the previous twelve months said they were told to keep it confidential, even though they believed it should have been reported to authorities.
The trajectory of that figure is what makes it genuinely alarming. It rose sharply from 42 per cent in 2023 to 57.6 per cent in 2025, before plateauing this year at 55.2 per cent, essentially unchanged. Bitdefender’s own analysts described that plateau as arguably just as troubling as the initial spike, since it suggests the surge in concealment pressure has now become entrenched rather than reversing. The United States led every region measured, with 68.6 per cent of American respondents reporting they were told to conceal a reportable breach, compared with 57.2 per cent in both Germany and the United Kingdom. Notably, the pressure to stay silent was not confined to any single organisational tier: managers reported facing this pressure at 56.8 per cent, closely mirrored by practitioners at 53.5 per cent, indicating the culture of concealment runs through entire organisations rather than being imposed top-down or bottom-up alone.
A Regulatory Paradox: Stricter Rules, Same Behaviour
What makes this finding particularly notable is the regulatory backdrop against which it is occurring. Bitdefender’s analysts pointed out that while organisations are working to incorporate US and European breach-disclosure regulations, cultural change has not kept pace with policy change, an acknowledgement that tightening legal requirements alone have not been sufficient to shift entrenched organisational instincts around disclosure.
The report’s authors were candid about the difficulty of solving this through policy alone. Changing behaviour may require making disclosure feel less punishing, they wrote, or perhaps the opposite: making secrecy impossible to justify. That framing captures a genuine tension facing regulators and corporate boards alike: stricter disclosure laws create clearer legal obligations, but if the internal incentive structure still rewards quiet containment over transparent reporting, the laws risk becoming a compliance exercise rather than a behavioural one.
Where the Breaches Are Actually Coming From
Bitdefender’s survey, conducted by Censuswide on behalf of the security firm between April and June 2026 among 1,201 IT and security professionals across France, Germany, Italy, Singapore, the UK and the US, found that more than half of all respondents had experienced a data breach or cybersecurity incident in the twelve months leading up to the survey. Cloud infrastructure or application breaches topped the list at 41.8 per cent, followed by business email compromise resulting in financial or data loss at 35.9 per cent, and ransomware at 25.6 per cent.
Notably, the specific mix varied significantly by region. Business email compromise was most common in the United States, while unauthorised cloud access predominated across the other five countries surveyed, a divergence that may reflect differences in cloud infrastructure maturity, identity governance practices, or the specific threat actor groups most active in each region.
The Confidence Gap Between Leaders and the Frontline
A second major theme running through the report is a persistent and sometimes stark mismatch between how confident organisational leaders feel about their AI-related visibility and what practitioners on the ground actually report. Overall, 51.8 per cent of respondents said they had full visibility into sanctioned and unsanctioned AI usage within their organisation, while 47.4 per cent acknowledged only partial or no visibility into individual shadow AI tools or personal accounts being used for work.
The gap widens considerably when the data is broken down by seniority. Managers were consistently far more confident in their AI visibility than practitioners: 57.8 per cent of managers believed they had full visibility, compared to just 45.9 per cent of practitioners, a 12 percentage point gap that Bitdefender flagged as the single largest divergence in the entire dataset. At the opposite extreme, only 0.5 per cent of managers reported having zero visibility into AI usage, compared to 4.5 per cent of practitioners, suggesting that those closest to daily operations see considerably more risk exposure than the leaders responsible for managing it.
This confidence gap was not isolated to AI. A smaller but still meaningful gap of 7.4 percentage points also appeared on the question of alignment between cybersecurity defenders and the broader business, reinforcing the pattern that organisational leadership may be systematically underestimating the operational realities facing their security teams.
America’s Paradox: Simultaneously the Most Confident and the Most Strained
Perhaps the report’s most counterintuitive finding concerns the United States specifically. Bitdefender’s analysts described US respondents as simultaneously the most strained and the most confident in the entire dataset, reporting higher rates of breach concealment, more AI-driven attacks, and greater tool complexity than any other country surveyed, and yet also reporting higher confidence in their security posture, stronger vendor relationships, and greater willingness to invest in new tools.
This apparent contradiction extended into how organisations think about their security vendors as well. Globally, 76.1 per cent of respondents said they would likely switch cybersecurity vendors due to concerns about data sovereignty, jurisdiction, or foreign government access to their data, with the United States again leading at 87.1 per cent, ahead of the UK at 85 per cent and Germany at 77 per cent. Bitdefender’s report did not attempt to fully resolve this tension, noting instead that the same cultural and competitive pressures driving higher security spending in the US may also be the ones driving inflated self-assessment of how well that spending is actually working. Together, the findings paint a picture of an industry that increasingly understands the shape of its own risk, from AI blind spots to breach concealment to sovereignty concerns, but continues to struggle with translating that understanding into consistent, resilient organisational practice.
